Skip to main content

​
Synopsis

​
Description

The bare capy command is the main sync loop. It authenticates you (if needed), pulls the latest encrypted secrets from the service, diffs them against your local .env, and writes any changes back. On first run in a project, it interactively initializes the project - picking an org, creating a project, encrypting your existing .env, and writing keep.lock. See Syncing secrets for the full flow.

​
Options

​
Examples

​
First-run behavior

On first run (no keep.lock in the project), Capy:
  1. Authenticates you in the browser.
  2. Prompts for an organization (or creates one, which generates a seed phrase).
  3. Prompts for a project (or creates one).
  4. Creates a development branch.
  5. Encrypts every value in your .env and uploads the ciphertext.
  6. Rewrites .env with capy:… snippets and gitignores it.
  7. Writes a commented-out copy of your original .env to .env.pre-capy.old (gitignored).
  8. Installs post-checkout and post-merge git hooks, which run capy status after branch switches and merges.
  9. Commits only keep.lock to git (a small versioning manifest with no keys or plaintext).
Last modified on May 20, 2026